ISO/IEC DIS 27004   Stage 40.60, close of voting Planning date, an estimate 14 Sep 2027 The recordFree checkKit USD 799 and watch USD 49 a month
B.10Annex
Annex B. Measurement construct examples

Corrective action implementation

Worked example in the published 2016 guidanceRecord 40 of 67Updated 2026-10-21

Corrective action has a due date, so it can be measured.

What the published 2016 guidance says

Corrective action has a due date, so it can be measured. Three figures are proposed: the share of planned actions not implemented, the share left undone with no good reason, and the trend of both. Illustrative targets are 0.4 to 0.0 and 0.2 to 0.0, with a falling trend over the last two periods. The evidence is the count of actions planned to date, those recorded as implemented by the due date, and those recorded as not taken with the reason. The report is a stacked bar of those done, those left undone with a good reason, and those left undone with none, plus an executive summary.

What it means in practice

Corrective action is a process with a due date. Measure the proportion not implemented and the proportion not implemented without a legitimate reason, then show the trend. The stacked bar makes the difference between "late" and "ignored" visible.

Status of this record. For B.10, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.

What good looks like

Keep the corrective action register with the due date and the closure evidence. Count the actions not implemented and the actions without a legitimate reason. Show the trend and attach the list.

Evidence an assessor asks for

  • ImprovementCorrective action log with due dates and closure evidence
  • Nonconformity and corrective actionReasons recorded for actions not taken
  • ImprovementStacked bar chart with executive summary

The question an assessor will ask

An assessor will ask for corrective action log with due dates and closure evidence. The test for B.10 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

  • Overdue actions with no recorded reason
  • Actions marked implemented with no evidence of completion

Before the next review

Before the next review, test this against one live record: overdue actions with no recorded reason.

What to check when the revision publishes

When DIS 27004 is published, compare the B.10 Corrective action implementation record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.